Privacy Policy

Effective: June 2026 · Last Updated: June 2026

This policy applies to the Finsl mobile application for Android and iOS, operated by Finslverse Private Limited, Kerala, India.

Finslverse Private Limited ("we", "our", or "us") operates the Finsl mobile application ("App"). This Privacy Policy explains how we collect, use, disclose, and protect information about you and your children when you use our App.

By using the App, you agree to this Privacy Policy. If you do not agree, please do not use the App.

1. Who Uses This App

The Finsl App is designed for two types of users:

Parents / Guardians (age 18+) — who create and manage the account
Children (age 10 to 17) — who use child accounts created and supervised by their parent or guardian

Child accounts can only be created by a verified parent or guardian. We do not knowingly collect data from children under age 10. If we learn that we have inadvertently collected data from a child under 10, we will delete it promptly.

2. Information We Collect

2A. Information You Provide

Parent / Guardian:

Full name
Indian mobile phone number (encrypted and hashed)
PAN number (used for identity verification only; not stored after verification)
Profile photo (optional)
UPI ID (encrypted at rest)

Child:

Name and date of birth
Profile photo (optional)
4-digit Magic Code / PIN (stored as a one-way bcrypt hash — never readable)
Chore completion history, routine tasks, and wallet transaction history

2B. Information Collected Automatically

Device ID (for child Magic Code login)
Firebase Cloud Messaging (FCM) token (for push notifications)
App usage data and error logs (anonymised)
IP address (used for security logging only; not shared)

3. App Permissions

The Finsl app requests the following device permissions. We only use each permission for the specific purpose described below:

CAMERA

Used when a parent or child takes a profile photo or uploads a chore completion photo as proof. We do not record video or access the camera at any other time.

RECEIVE_SMS

Used on Android to automatically read OTP (One-Time Password) messages sent to the parent's phone for login and verification using Android's SMS Retriever API. We read only the specific OTP message and do not access, store, or share any other SMS messages on your device.

POST_NOTIFICATIONS

Used to send push notifications for chore completions, payment requests, wallet credits, and routine updates. You can disable notifications at any time in the App settings or your device settings.

USE_FULL_SCREEN_INTENT

Used to display urgent payment request alerts as full-screen notifications when a child requests money, even when the phone is locked. This is required on Android 14+ for critical payment alerts and is disclosed to users during onboarding.

REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

Used to ensure push notifications are delivered reliably, even when battery optimisation is active. This allows time-sensitive payment alerts to reach parents promptly without being delayed by the OS.

WAKE_LOCK

Used to keep the processor awake long enough to process and deliver incoming push notifications. This does not keep the screen on or significantly drain the battery.

FOREGROUND_SERVICE / FOREGROUND_SERVICE_SHORT_SERVICE

Used to display payment request alerts reliably on Android when the app is not in the foreground. A short-lived foreground service is started only when a payment alert needs to be shown to the parent.

VIBRATE

Used to vibrate the device when a push notification is received, as a supplementary alert alongside the notification sound.

INTERNET

Required for all core app functionality — communicating with our servers, loading data, and processing transactions.

READ_MEDIA_IMAGES

Used when a user selects a photo from their device gallery for their profile picture or as chore completion proof. We access only the specific images the user explicitly selects — we do not scan or access your full photo library.

4. How We Use Your Information

To provide and operate the Finsl service
To verify identity via OTP and PAN
To send push notifications for chores, rewards, and payment requests
To facilitate UPI-based payments between parents and children
To display transaction history, analytics, and earnings summaries
To enforce spending limits set by parents
To improve app performance and fix bugs

5. Children's Privacy

We take children's privacy seriously and apply additional protections:

Child accounts can only be created by a verified parent or guardian (age 18+)
We collect only the minimum data necessary for the service
Children's data is never used for advertising or marketing
Children cannot share personal information publicly within the app
Parents can view, edit, or delete their child's data at any time
We do not knowingly collect data from children under 10 years of age

6. Data Storage and Security

All data is stored on AWS infrastructure in the ap-south-1 (Mumbai, India) region
Sensitive data (phone numbers, UPI IDs) is encrypted using Fernet symmetric encryption
Phone numbers are additionally hashed with SHA-256 for secure lookup
Magic Codes / PINs are hashed with bcrypt and never stored in plain text
All data transmission uses TLS/HTTPS encryption
Access to production data is restricted to authorised personnel only

7. Data Sharing

We do not sell your personal data. We share data only with the following trusted service providers, strictly for operating the app:

Amazon Web Services (AWS) — cloud hosting, storage, and SMS delivery (India region)
Google Firebase — push notification delivery (anonymised FCM tokens only)
AWS Pinpoint — OTP SMS delivery (phone number used only for OTP)
Law enforcement / regulatory authorities — only when required by applicable Indian law

8. Notifications and Communication

We send push notifications for chore completions, payment requests, wallet credits, and routine updates. You can disable notifications at any time in the App settings or your device settings. Core app functionality is not affected by disabling notifications.

9. Your Rights

You have the right to:

Access the personal data we hold about you or your child
Request correction of inaccurate data
Request deletion of your account and all associated data
Withdraw consent for data processing (may affect service availability)
Lodge a complaint with the relevant data protection authority

To exercise any of these rights, contact us at support@finsl.co

10. Data Retention

Active account data is retained as long as your account is active
Upon account deletion, personal data is deleted within 30 days
Transaction records may be retained for up to 7 years for legal and financial compliance
Anonymised analytics data may be retained indefinitely

11. Third-Party Services

The App integrates with third-party UPI applications (such as Google Pay, PhonePe, and Paytm) for payment processing. When you use these apps, their own privacy policies apply. Finslverse is not responsible for the data practices of third-party UPI applications.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the App or via SMS. Your continued use of the App after such notification constitutes acceptance of the updated policy.

13. Contact Us

Finslverse Private Limited

📧 Technical: tech@finsl.co

📧 Support: support@finsl.co

🌐 www.finslverse.co

📍 Kerala, India